Cloud Computing and Cryptography
Cloud fundamentals
NIST defines the essential characteristics (on-demand self-service, broad network access, resource pooling, rapid elasticity, measured service), three service models - IaaS, PaaS, SaaS - and four deployment models: public, private, community, hybrid. The shared responsibility model is the most tested idea: the provider secures the cloud (physical, hypervisor, managed service internals), the customer secures in the cloud (identities, data, configuration). Misunderstanding this boundary is the root of most cloud breaches.
Know the threat list: misconfigured storage (public S3 buckets), leaked credentials and over-permissive IAM roles, insecure APIs, account hijacking, and SSRF against the instance metadata service at 169.254.169.254 (IMDSv2 mitigates it). Controls include CASB, CSPM, IAM least privilege, MFA, KMS, and encryption at rest and in transit. Containers share the host kernel and are isolated by namespaces and cgroups; VMs have a hypervisor boundary.
Cryptography
Symmetric ciphers (AES, 3DES, ChaCha20) are fast and used for bulk data; asymmetric ciphers (RSA, ECC, Diffie-Hellman) are slow and used for key exchange and signatures. Hashing (MD5, SHA-1, SHA-256, bcrypt, Argon2) is one-way integrity, never encryption; salt defeats rainbow tables. HMAC is keyed integrity, a digital signature adds non-repudiation, and PKI binds identities via X.509 certificates issued by a CA from a CSR.
Worked example
A web app must transmit gigabytes securely. Rule of thumb: use asymmetric only to establish and exchange a symmetric key, then encrypt the bulk with AES in a mode like GCM. Known blunders to recognize: ECB (pattern leakage), MD5/SHA-1 for passwords, and unauthenticated CBC.